The premise of this layer is that a machine-learning score which drops traffic on its own is itself an attack surface: an adversary who can make legitimate traffic look anomalous can make the firewall block it, and a model that drifts does the same thing without any adversary. So detection is treated as evidence, not as a verdict.
Telemetry — what it looks at
flowd runs on the box, cheaply, and unifies several sources into flow records. It runs no models.
| Source | Contributes |
|---|---|
pf | State table plus pflog rule-match events, so a flow knows which rule admitted it |
| Flow export | 5-tuple, bytes, packets, duration, TCP flags, direction, zone |
| Suricata EVE | Alerts, flow, anomaly and app-layer events (HTTP, DNS, TLS) — signature and protocol context |
| Squid | Access and ICAP logs — URL, category, verdict — for the web-proxy features |
Detection is tiered
The fast path is on-box and deterministic: Suricata signatures plus flood and reconnaissance protection. It is the always-on safety net and it needs no network.
The deep path is off-box. Telemetry is streamed to an analysis system running the heavy models — an autoencoder for zero-day anomaly detection, a supervised classifier for attack class, optionally a graph model over flow graphs — which returns a risk score, a class and an explanation of which features drove it.
The appliance carries no model weights and no ML runtime. That is a deliberate constraint: an edge device's job is passing packets, and its only egress for this purpose is the endpoint you configure.
Confidence, fused from independent signals
Every candidate source gets a confidence value from 0 to 100, fused — weighted and capped — from signals that do not share a failure mode.
| Signal | Source | Weight |
|---|---|---|
| Signature severity | Suricata EVE via flowd | High at severity 1 |
| Threat-intel reputation | Feed match — block feed (strong) or suspect feed (grey) | High / medium |
| Behavioral anomaly | Deviation from the learned baseline | Scaled |
| Off-box AI risk | Deep model score and class, when configured | Scaled |
The corroboration rule. A high-confidence automatic action requires at least two independent positive signals. A lone signal caps at the grey band — throttle or suggest — and never an automatic block. A threat-feed hit by itself is grey, however reputable the feed.
Graduated response
Confidence maps to a tier, bounded by an autonomy ceiling the operator sets. Default thresholds are grey at 50 and block at 80.
Low or medium confidence — log it and move on
The event is recorded and surfaced in the console. Nothing about the running configuration changes. During the initial learning window the whole layer stays here, because there is no baseline yet to judge against.
High confidence — propose a change for a human
The harness drafts the block or rule as a config diff with its rationale and a risk rating. An operator approves it, and it goes through the same validate → render → apply path as any hand-made change.
Grey and suspect — degrade it, do not cut it
The source joins the greylist table, which is piped to a slow dummynet queue. If that was a false positive the collateral is a slow connection, not an outage. Repeat offenses or rising confidence escalate to a block; quiet sources age out.
Two independent signals agree — drop it, with a timer
The source lands in the blocklist table that a single top-of-ruleset rule drops. Automatic blocking needs an opted-in category and corroboration; management addresses, HA peers and operator allowlists are never eligible. Every entry expires and every action has one-click undo.
Throttling is the tier most products skip. The source joins a greylist pf table which is piped to a slow dummynet queue — the same QoS dataplane the appliance already ships — so suspect traffic is degraded rather than cut. If the call was wrong, the collateral is latency instead of an outage, which is what makes automatic response safe enough to enable.
Escalation and de-escalation are both automatic: repeat offenses or rising confidence inside a window move a source from throttle to block, and a source that goes quiet ages out.
Autonomy levels
| Level | Grey / suspect | High confidence, opted-in category |
|---|---|---|
observe | Log | Log |
suggest — the default | Propose | Propose |
auto-throttle | Throttle automatically | Propose a block |
auto-mitigate | Throttle automatically | Block automatically, with a TTL |
Observe and suggest are available on every tier including the free one. Automatic mitigation is a paid entitlement, as is the off-box analysis endpoint. Licensing.
Enforcement plane
An action is a table entry with an expiry, never a rule the system wrote into your ruleset. Table entries are auditable, reversible, and cannot reorder or shadow the policy you wrote.
| Tier | Mechanism |
|---|---|
| Block | The rubix_blocklist pf table, dropped by one rule at the top of the ruleset |
| Throttle | The rubix_greylist pf table, piped to a slow dummynet queue |
| Feed match | pf tables refreshed by the feed fetcher, plus an on-box reputation index |
Behavioral learning
Flow records feed a persistent baseline profile store on /var, which survives upgrades: per source and service, the normal volume, ports, peers and time-of-day. Anomaly means deviation from that — a new port, a volume spike, a new peer, beaconing periodicity. It is the cheap, always-on, unsupervised complement to the off-box supervised model.
Operator verdicts persist. Confirming a detection or marking it a false positive adjusts the local baseline and allowlist, and is exported as labeled telemetry for off-box retraining — so the system measurably improves on your traffic rather than on a public dataset.
During an initial learning window the layer stays in observe/suggest regardless of the autonomy level. It will not act on a network it has not learned yet.
Model routing
Backends are named providers: your private OpenWebUI deployment, a frontier API, or several at once. Each is a name, a kind, a base URL and a reference into the secret store — never an inlined credential. The kind selects a thin adapter, so adding a native protocol does not touch any caller.
Analysis tasks are routed to a provider and model by role:
triage— fast and cheap, for inline scoring of event batches at low latency.deep-analysis— the strongest model available, to investigate one incident and return a class, an explanation and a suggested config change.summarize— reporting and digests.
An unset role falls back to the default. Which makes privacy a routing decision you make explicitly: triage can run on a local model while summarization uses a frontier one, or everything can stay private.
Guardrails
- At least two corroborating signals for any automatic block. No exceptions, at any autonomy level.
- The allowlist — management addresses, HA peers, the firewall's own addresses, operator-defined critical sources — is never throttled and never blocked.
- Automatic blocks are rate-capped. Exceeding the cap trips safe mode (observe-only) and raises an alert, because a flood of AI blocks is a fault, not a busy night.
- Every action carries its explanation and features, an audit entry, a TTL and one-click undo.
- A model or feed outage degrades to the deterministic fast path. It does not fail open and it does not silently fail closed.
- Cold start: observe-only until a baseline exists.
- AI is never the only control between a packet and a decision.
What we deliberately do not do
- No model weights and no training on the appliance.
- No automatic block without a confidence threshold, a category opt-in, the allowlist, a TTL and an audit entry.
- No automatic block on a single signal, ever.
Status. Shipping: flowd telemetry; the confidence model, graduated response, escalation, autonomy levels and guardrails in aid; model routing; observe and suggest; the threat-intel fetcher; TLS inspection; and the console's flow monitor and AI insights screens. Not shipping: the persistent baseline store and feedback loop, and off-box deep models (a licensed entitlement — not claimed as shipping). Build status.
TLS and the web proxy
URL and content classification and phishing/malware detection run on proxy and ICAP telemetry. TLS inspection is shipping: Squid ssl-bump, an on-box intercept CA, pf redirect of :443 only, QUIC drop, zone scope, and banking, health and government splice so those sessions are not decrypted. Hostname, SNI and DNS filtering work without decrypt; path and file-type rules need inspection.